I had started with the SPA template, and added Unity 3.0 plus Unity bootstrapper for ASP.NET Web API. The AccountController code the template adds, comes with two public constructors.

Unity starts with matching the most specific constructor if no InjectionConstructor is provided, by looking at the constructor argument list, if multiple ctors exist, it will match the one with the longest argument list (hence not the default ctor) and will
not be able to instantiate the controller.

Resolution is (depending on the testing approach) either provide resolution logic for UserManager<IdentityUser> and ISecureDataFormat<> types or make the non-default constructor on the template generated AccountController type as not public.